Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Type | Workbook |
| Solution | Hybrid Attack - Cloud & Identity |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AADNonInteractiveUserSignInLogs |
✓ | ✗ | ✓ | |
AADServicePrincipalSignInLogs |
✓ | ✗ | ✓ | |
AADUserRiskEvents |
✓ | ✗ | ✓ | |
AuditLogs |
✓ | ✗ | ✓ | |
AzureActivity |
ActivityStatusValue == "Success"Caller contains "@"OperationNameValue == "Microsoft.Authorization/roleAssignments/delete"OperationNameValue contains "WebApplicationFirewall"OperationNameValue contains "azureFirewall"OperationNameValue contains "firewallPolicies"OperationNameValue contains "networkSecurityGroup"OperationNameValue contains "roleAssignments"OperationNameValue contains "routeTable"OperationNameValue contains "routes/"OperationNameValue contains "subnets"OperationNameValue contains "virtualNetworkGateway" |
✗ | ✗ | ✗ |
AzureDiagnostics 🔶 |
Category == "kube-audit"Category has "kube-audit" |
✗ | ✗ | ✗ |
BehaviorAnalytics |
✓ | ✗ | ✗ | |
CloudAppEvents |
ActionType in "MailItemsAccessed,New-InboxRule,Set-InboxRule,Set-Mailbox" |
✓ | ✗ | ✓ |
CloudAuditEvents |
✓ | ✗ | ✓ | |
CloudProcessEvents |
✓ | ✗ | ✓ | |
CloudStorageAggregatedEvents |
✓ | ✗ | ✓ | |
CommonSecurityLog |
DeviceEventClassID == "0100044547"DeviceProduct != "Cortex XDR"DeviceProduct !has "ASM"DeviceVendor == "Fortinet" |
✓ | ✓ | ✓ |
DeviceInfo |
✓ | ✗ | ✓ | |
DeviceNetworkInfo |
✓ | ✗ | ✓ | |
Event |
✓ | ✓ | ✗ | |
IdentityInfo |
✓ | ✗ | ✓ | |
SigninLogs |
OperationName in "Add app role assignment to service principal,Add delegated permission grant,Add service principal credentials,Admin deleted security info,Admin registered security info,Admin updated security info,Consent to application,GetBlob,ListBlobs,ListBlobsHierarchySegment,ListContainersSegment,Set domain authentication,Set federation settings on domain,User changed default security info,User deleted security info,User registered security info,User updated security info"OperationName has_any "clusterrolebindings,rolebindings"OperationName has_any "cronjobs,daemonsets"OperationName has_any "cronjobs/create,daemonsets/create" |
✓ | ✗ | ✓ |
StorageBlobLogs |
StatusCode in "200,206" |
✓ | ✗ | ✓ |
ThreatIntelIndicators |
ObservableKey == "ipv4-addr:value" |
✓ | ✓ | ✗ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Workbooks · Back to Hybrid Attack - Cloud & Identity